connection terminated unexpected server authentication certificate windows 10

%3CLINGO-SUB%20id%3D%22lingo-sub-863394%22%20slang%3D%22en-US%22%3Econnection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-863394%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20windows%2010%20users%20keep%20getting%20this%20error%20message%20many%20times%20when%20they%20try%20to%20log%20into%20RDP%20sessions.%3C%2FP%3E%3CP%3EThey%20get%20this%20error%20for%20about%207%20times%20then%20logged%20in.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20looked%20around%20but%20don't%20have%20a%20good%20answer%20or%20findings.%3C%2FP%3E%3CH4%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%20id%3D%22toc-hId-1428963390%22%3EThe%20connection%20has%20been%20terminated%20because%20an%20unexpected%20server%20authentication%20certificate%20was%20received%20from%20the%20remote%20computer.%3C%2FH4%3E%3CP%3E%3CEM%3ETry%20connecting%20again.%20If%20the%20problem%20continues%2C%20contact%20the%20owner%20of%20the%20remote%20computer%20or%20your%20network%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22IL_AD%22%3Eadministrator%3C%2FSPAN%3E.%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWere%20on%201903%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-864166%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-864166%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397375%22%20target%3D%22_blank%22%3E%40jvalois%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20anything%20in%20the%20Eventlog%20on%20the%20machine%20they%20are%20RDPing%20to%3F%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20the%20machine%20they%20are%20RDPing%20to%20also%20Windows%2010%201903%20or%20are%20they%20connecting%20to%20and%20RDSH%20server%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-867375%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-867375%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342845%22%20target%3D%22_blank%22%3E%40PaulaSillars%3C%2FA%3EWindows%20server%202008%20SP1%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CFONT%3EThe%20description%20for%20Event%20ID%2054%20from%20source%20RDPDR%20cannot%20be%20found.%20Either%20the%20component%20that%20raises%20this%20event%20is%20not%20installed%20on%20your%20local%20computer%20or%20the%20installation%20is%20corrupted.%20You%20can%20install%20or%20repair%20the%20component%20on%20the%20local%20computer.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EIf%20the%20event%20originated%20on%20another%20computer%2C%20the%20display%20information%20had%20to%20be%20saved%20with%20the%20event.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EThe%20following%20information%20was%20included%20with%20the%20event%3A%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%5CDevice%5CRdpDrDvMgr%3CBR%20%2F%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EThe%20Terminal%20Server%20security%20layer%20detected%20an%20error%20in%20the%20protocol%20stream%20and%20has%20disconnected%20the%20client.%20Client%20IP%3A%2010.1.2.34.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EThis%20is%20what%20I%20get%20from%20the%20event%20viewer%2C%20is%20there%20another%20place%20I%20can%20look%20at%3F%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-868597%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-868597%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3Ecan%20you%20remember%20what%20exactly%20triggered%20this%20issue%3F%20like%20after%20changing%20something%20on%20the%20server%20or%20installing%20a%20new%20role%20or%20program%20on%20it%3F%20or%20did%20the%20problem%20suddenly%20started%20happening%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-869676%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-869676%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397375%22%20target%3D%22_blank%22%3E%40jvalois%3C%2FA%3E%26nbsp%3BIs%20it%20a%20virtual%20server%20or%20physical%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20the%20issue%20related%20to%20loading%20of%20users%20onto%20the%20server%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20try%20c%3CSPAN%3Ehanging%20the%20remote%20desktop%20setting%20on%20the%20server%20to%20allow%20connections%20from%20a%20computer%20running%20any%20version%20of%20Remote%20Desktop%20(less%20secure)%20to%20see%20whether%20the%20issue%20still%20exists.%26nbsp%3B%20I%20did%20see%20this%20a%20few%20months%20back%20with%20an%20update.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1420200%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1420200%22%20slang%3D%22en-US%22%3E%3CP%3E1.%20Click%20the%20Windows%20or%20Start%20button%20and%20type%20%22certmgr.msc%22.%20This%20will%20start%20the%20Certificate%20Manager.%3C%2FP%3E%3CP%3E2.%20Click%20on%20Action%20%7C%20Find%20Certificates%20and%20type%20%22Safeguard%22%20in%20the%20Contains%20field%20and%20click%20on%20the%20Find%20Now%20button.%3C%2FP%3E%3CP%3E3.%20The%20results%20should%20be%20displayed%20below%2C%20expand%20the%20Issue%20To%20column%20and%20select%20(to%20highlight)%20SafeguardCluster.%3C%2FP%3E%3CP%3E4.%20Right-click%20and%20select%20Delete.%3C%2FP%3E%3CP%3E5.%20Click%20Yes%20on%20the%20questions.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342845%22%20target%3D%22_blank%22%3E%40PaulaSillars%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1423827%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1423827%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397375%22%20target%3D%22_blank%22%3E%40jvalois%3C%2FA%3E%26nbsp%3Bhad%20similar%20issue%20on%20Terminal%20server%20(2008R2)%20logging%20in%20from%20Win%2010%201903.%20found%20out%20it%20was%20being%20caused%20by%20the%20RDP%20certificate.%20regenerated%20the%20Certificate%20and%20issue%20was%20resolved%20for%20us.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1647234%22%20slang%3D%22en-US%22%3ERe%3A%20connection%20terminated%20unexpected%20server%20authentication%20certificate%20windows%2010%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1647234%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397375%22%20target%3D%22_blank%22%3E%40jvalois%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20found%20solution%20as%20IP%20conflict%20remote%20machine%20with%20other%20VM.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi Team, 

 

My windows 10 users keep getting this error message many times when they try to log into RDP sessions.

They get this error for about 7 times then logged in.

 

I've looked around but don't have a good answer or findings.

The connection has been terminated because an unexpected server authentication certificate was received from the remote computer.

Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.

 

Were on 1903 

 

7 Replies
Highlighted

@jvalois 

Is there anything in the Eventlog on the machine they are RDPing to?  

Is the machine they are RDPing to also Windows 10 1903 or are they connecting to and RDSH server?

Highlighted

@PaulaSillarsWindows server 2008 SP1 

The description for Event ID 54 from source RDPDR cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
\Device\RdpDrDvMgr
 
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: 10.1.2.34.
 
This is what I get from the event viewer, is there another place I can look at?
Highlighted
Hi,
can you remember what exactly triggered this issue? like after changing something on the server or installing a new role or program on it? or did the problem suddenly started happening?
Highlighted

@jvalois Is it a virtual server or physical? 

 

Is the issue related to loading of users onto the server?

 

Also, try changing the remote desktop setting on the server to allow connections from a computer running any version of Remote Desktop (less secure) to see whether the issue still exists.  I did see this a few months back with an update.

Highlighted

1. Click the Windows or Start button and type "certmgr.msc". This will start the Certificate Manager.

2. Click on Action | Find Certificates and type "Safeguard" in the Contains field and click on the Find Now button.

3. The results should be displayed below, expand the Issue To column and select (to highlight) SafeguardCluster.

4. Right-click and select Delete.

5. Click Yes on the questions.

@PaulaSillars 

Highlighted

@jvalois had similar issue on Terminal server (2008R2) logging in from Win 10 1903. found out it was being caused by the RDP certificate. regenerated the Certificate and issue was resolved for us. 

Highlighted

@jvalois 

I found solution as IP conflict remote machine with other VM.